WebProcess does have its own, more restrictive sandbox, although it's not as tight as Chrome's: https://github.com/WebKit/webkit/blob/master/Source/WebKit2/Web

WebProcess does have its own, more restrictive sandbox, although it's not as tight as Chrome's: https://github.com/WebKit/webkit/blob/master/Source/WebKit2/WebProcess/com.apple.WebProcess.sb.in https://github.com/WebKit/webkit/blob/master/Source/WebKit2/... For IPC they use something custom (part of the WebKit repo) called "CoreIPC".